Securing MCP Servers and AI Agent Tools: A Practical Checklist

What can go wrong

Risk	What happens	Named in
Prompt injection and goal hijack	Text the agent reads (an email, a web page, a tool result) carries instructions that redirect it, for example to send data out	OWASP LLM01:2025 Prompt Injection; ASI01 Agent Goal Hijack
Excessive agency and tool misuse	The agent has more tools or permissions than its task needs, or chains legitimate tools into a harmful action	OWASP LLM06:2025 Excessive Agency; ASI02 Tool Misuse and Exploitation
Identity and privilege abuse	Tokens with broad scopes, or tokens issued for another service, let a compromised agent or server act far beyond its purpose	ASI03 Identity and Privilege Abuse; MCP: Token Passthrough, Scope Minimization
Supply chain	A malicious or typo-squatted MCP server, package or tool description is installed	OWASP LLM03:2025 Supply Chain; ASI04 Agentic Supply Chain Vulnerabilities
Local server compromise	A one-click local server configuration runs an arbitrary command with the user's privileges	MCP: Local MCP Server Compromise; ASI05 Unexpected Code Execution
Confused deputy	An MCP proxy that reuses one OAuth client for a third-party API lets an attacker obtain access without the user's consent	MCP: Confused Deputy Problem
Server-side request forgery	OAuth discovery URLs from a malicious server point the client at internal addresses or cloud metadata endpoints	MCP: Server-Side Request Forgery
Memory poisoning	Injected content is stored in the agent's memory or retrieval index and influences later sessions	ASI06 Memory and Context Poisoning

Checklist for teams that use agents and MCP servers

Supply chain

Install MCP servers only from sources you can verify; prefer servers whose publisher proves its namespace (for example in the official MCP Registry) and pin versions.
Review the tool names and descriptions a server exposes: they are instructions to the model, and a changed description can change behaviour.
Run local servers sandboxed, with access only to the directories and network they need. The MCP specification requires clients to show the exact command and get explicit approval before a one-click local server runs.

Permissions and tokens

Give each agent the fewest tools and the narrowest scopes its task needs; split read and write tools, and ask for more scope only when an action needs it (MCP: progressive, least-privilege scopes).
Require human approval for actions that send data out, spend money, delete or change records.
Servers must accept only tokens issued for themselves and never pass a client's token through to another API (MCP: token passthrough is forbidden).
Servers that proxy a third-party API must ask each client for consent, show the client's name and redirect address, and block framing of the consent page (MCP: Confused Deputy mitigations).
Never treat a session or state identifier as proof of identity; bind it to the authenticated user (MCP: State Handle Hijacking).

Prompt injection

Treat everything the agent reads, including tool results, as untrusted data, not instructions.
Restrict where the agent can send data: allowlist domains and recipients for outbound tools.
Validate tool inputs against a schema and check outputs before they reach another system (OWASP LLM05:2025 Improper Output Handling).
Do not put secrets or credentials in prompts, system prompts or tool descriptions (OWASP LLM07:2025 System Prompt Leakage).

Network

Use HTTPS for every MCP and OAuth address, and block private, loopback and link-local ranges when a client fetches discovery URLs (MCP: SSRF mitigations).
Rate-limit servers and agents to contain runaway loops and abuse (OWASP LLM10:2025 Unbounded Consumption).

Monitoring and response

Log every tool call with the agent, user, tool and outcome, without logging sensitive inputs you do not need.
Keep a kill switch: a way to revoke an agent's tokens and disable its tools at once (ASI10 Rogue Agents).
Test with injection attempts before go-live and after each new tool.
Plan how an agent incident is classified and reported: see incident response for AI agents.

How this maps to the regulations

Regulation	Where agent security fits
NIS2	Supply chain security, secure development and vulnerability handling, and access control are minimum measures (Art. 21(2)(d), (e), (i)).
DORA	Agents and MCP servers are ICT assets and services: they belong in the ICT risk management framework and asset inventory and, when a provider runs them, in third-party risk management and the register of information (Arts. 6, 8, 9, 28).
GDPR	Security appropriate to the risk, including the ability to restore availability and regular testing (Art. 32); data protection by design and by default (Art. 25).
Cyber Resilience Act	If you sell or distribute an MCP server or agent software in the EU, it can be a product with digital elements; actively exploited vulnerabilities must be reported since 11 September 2026 (Art. 14). See CRA reporting.

An example: our own MCP server

Our ClevSec MCP server applies several of these choices: every tool is read-only and declared as such, there is no language model inside, inputs are validated against a schema and never logged, calls are rate-limited, and Pro access uses OAuth with tokens issued only for that endpoint.

Check your suppliers too. The Vendor Security Assessment Pack includes a vendor questionnaire and risk register you can extend to agent and MCP providers.